The documentation says that
crypto_strong is set depending on the algorithm used. So it will never go from false to true, so yes, this might result in an infinite loop.
Use it instead to see if you should trust the result. If it is true, the string should be secure.
(you should also never design your own crypto algorithms for anything other than academic interest)
because this is codereview, I also have a couple of notes regarding your code:
- Why do you divide the length by 2? Seems unnecessary. If it does have a purpose, comment on it.
TRUE: use case uniformly. either
$hex = bin2hex($bytes);
just make this one line:
- it is convention to use camelCase for variables, so
Length should be
length and the function name